Snapshot 253791
Normalized text
Scripts and page chrome removed; this is what change detection compares.
New
Announcing AISIX: The AI-Native AI Gateway for LLMs and AI AgentsLearn More
Learn More
Privacy Policy
Published: August 15, 2022
Updated: November 9, 2026
For information specific to API7 Cloud, see the API7 Cloud Privacy Notice.
1. Purpose and Scope of this Privacy Policy
APISEVEN PTE. LTD ("API7.ai", "API7", "we" or "us" or "our") provides this Privacy Policy to inform you of our policies and procedures regarding the collection, processing, and disclosure of information about you, and what rights you have while we hold that information. This Privacy Policy describes our practices regarding personal data we collect from users of our publicly available websites, including sites located on api7.ai as well as any other pages that link to this Privacy Policy (the "Sites"), and in connection with our products and services ("Services"). We use the terms "personal data" and "personal information" interchangeably to mean information that identifies or reasonably identifies an individual.
2. Information Collection
2.1 Information You Provide to Us
In the course of using our Sites and Services, you may provide us with certain information about you, such as when you participate in any interactive features of the Sites, fill out a form, subscribe to an email list or newsletter, request customer support, request a whitepaper, or otherwise communicate with us. The types of information that we may collect include your name, job title, company name, phone number, email address, physical address, and other information relating to your proposed use of our products and services or our events and training. We may also collect the information you supply to us concerning your preferences and interests expressed in the course of the use of our Sites and Services.
2.2 Automatically Collected Information
When you access or use our Sites and Services, we automatically collect information about you, including:
Log Information: We collect log information about your use of the Sites and Services, including the type of browser you use, access times, pages viewed, browser type, your IP address, and the page you visited before navigating to our Services.
Device Information: We collect information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers, and mobile network information.
Information Collected by Cookies and Other Tracking Technologies: Like most online services, we may use cookies and other technologies, such as web beacons, web storage, and unique advertising identifiers, to collect information about your activity, browser, and device. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Sites are popular and count visits. Web beacons are electronic images that may be used on our Sites or emails and help deliver cookies, count visits and understand usage and campaign effectiveness.
2.3 Information We Collect from Other Sources
We obtain information from other sources and combine that with information we collect through our Sites and Services. For example, we may collect information about you from third parties, including but not limited to data enrichment service providers and publicly available sources such as social media pages. In addition, we may receive demographic and business industry information about you from third parties to help us better understand our users and to improve and market our Services. However, please do not provide us with any sensitive personal data through these third parties. We are not responsible for the data protection and usage practices of these third-party platforms.
3. Our use of cookies and similar technologies
Our website and related online services use cookies and similar technologies to enable certain features and help collect information about your visit. "Cookies" are small text files, usually containing a unique string of letters and numbers, that are stored on your hard drive by a site. Cookies can be read by the site when you return to the site using the same browser, thereby collecting information about your usage over time. Among other things, we use cookies and other technologies to see which areas and features are popular and to count visits, which helps us improve our website, products and your experience.
Web beacons. We may use web beacons to collect information. Web beacons are electronic images that can be used on our website, products or emails. We use web beacons to send cookies, count visits, understand usage and campaign effectiveness, and tell if emails have been opened and acted upon. Analytics and Advertising. We partner with third parties to provide analytics and advertising services related to our website and products. These third parties use cookies, web beacons or similar technologies to automatically collect certain of the information described above from visitors to our websites and products over time and across third-party websites and mobile applications for analytics and advertising purposes. We use analytics information to analyze and improve our services. Our advertising partners use this information to understand your interests and to show you relevant advertisements about our and other products and services.
We promise not to use cookies and similar technologies for any purpose other than those described in this Privacy Policy. Most browsers provide users with the function of clearing browser cache data, and you can perform corresponding data-clearing operations in the browser settings function. If you do so, you may not be able to use the services or corresponding functions provided by us that rely on cookies and similar technologies.
4. Our Use of Personal Information
Generally, we collect and process personal information about you with your consent to provide the products you use, operate our website and business, perform our contractual and legal obligations, and protect the security of our systems and customers or necessary to perform other obligations as described in this Privacy Policy and our notices to you.
For example, we may use any of the categories of personal information described above:
To operate, maintain and improve our internal operations, systems, sites and products.
To understand you and your preferences to enhance your experience and enjoyment of using our website - and products, to provide recommendations, solicit feedback, and advertise better.
To monitor and analyze user interactions with our website and products to identify trends, usage and activity patterns.
To respond to your comments and questions, and to provide technical support or customer service.
To provide and deliver the product you request.
To comply with applicable laws, rules or regulations, cooperate and defend legal claims and audits.
To communicate with you about promotions, upcoming events and other news about the products and services offered by us and our partners.
To plan and develop company events.
To protect the website and products, and investigate and deter fraudulent, unauthorized or illegal activity.
5. Rights and Approaches of Personal Information Management Access, Correction or Deletion.
Depending on what jurisdiction you are located in, you may have certain rights in relation to your personal data. If you expect to request access, correction or deletion of any personal information we hold, or if we change the way we use your information (where permitted by applicable law, we reserve the right to charge you a fee), please do so here or via Email your request to support@api7.ai. We may take certain steps to verify requests submitted using information available to us, including your email address and any information associated with your account. Where allowed, we may ask you to provide your government identification to verify your account. Personal data you provide to us for verification will only be used to verify and maintain records regarding your request. However, we may deny requests that are unreasonable, prohibited by law or not required by applicable law.
How to control your communication preferences. You may stop receiving promotional emails from us by clicking on the "unsubscribe link" provided in such emails, or by contacting us via the contact details listed above. Additionally, you can change your preferences in our Preference Center. We will make every effort to process all unsubscribe requests promptly. If you opt-out, we may still send you transactional communications (for example, non-promotional emails such as emails about training and events you have registered for and technical or security notices).
Cookies. Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to delete cookies and refuse cookies. If you choose to delete reject cookies, it may affect certain features or services of our website or other products. Additional choices regarding information collected through the use of cookies and similar technologies are described in the "Our Use of Cookies and Similar Technologies" section above.
Analytics and Online Advertising. Our third-party analytics and advertising partners may offer you the option to opt-out of certain information collection. For more information on the applicable choices they offer you, please see the "Our Use of Cookies and Similar Technologies" section above. No track. Web browser signals and other similar mechanisms (such as "Do Not Track") can instruct you to opt-out of tracking in a number of ways, and while we and others provide you with the choices described in this Privacy Policy, we currently do not have to follow these mechanisms.
6. Rights and Approaches of Personal Information Management
We will not share your information with any unrelated third parties without your consent, except in the following cases: We may share your information with our affiliates, third-party service providers, contractors and agents only to improve your experience of visiting and using our website and using our products. If we share your information with any of the above third parties, we will endeavour to ensure that the third party uses your information in compliance with this policy and other appropriate confidentiality and security measures that we require of them.
As our business continues to develop, we and our affiliates may enter into mergers, acquisitions, asset transfers or similar transactions, and your information may be transferred as part of such transactions. We will comply with the requirements of relevant laws and regulations, notify you before the transfer, ensure the confidentiality of the information during the transfer, and continue to perform the corresponding responsibilities and obligations after the change.
We may also disclose your information for the following reasons:
To comply with applicable laws and regulations and other relevant regulations.
To comply with judicial judgments, rulings or other legal processes.
To comply with the requirements of relevant government agencies or other competent authorities.
We have reason to believe that we need to comply with relevant laws and regulations.
Reasonable and necessary purposes to implement the relevant service agreement or this Privacy Policy, safeguard social and public interests, handle complaints/disputes, and protect the personal and property safety or legitimate rights and interests of our customers, us or our affiliates, other users or employees.
When legally authorized by you.
If we disclose your information for the above reasons, we will promptly inform you on the basis of complying with relevant laws and regulations and this Privacy Policy.
7. How We Store and Protect Personal Information
For information about where API7 Cloud data is processed, see the API7 Cloud Privacy Notice. For our other Sites and Services, the information we collect about you is stored on our servers in Singapore, subject to the international transfers described below. Generally, we only retain your information for as long as we provide services to you, and no longer than is necessary to satisfy the relevant purpose of use. After the necessary period, we will delete or anonymize your information, unless otherwise provided by laws and regulations.
However, in the following circumstances, and only for the purposes related to the following circumstances, we may need to retain your information or part of it for a longer period of time:
To comply with applicable laws and regulations and other relevant regulations.
To comply with court judgments, rulings or other legal process requirements.
To comply with the requirements of relevant government agencies or other competent authorities.
We have reason to believe that we need to comply with relevant laws and regulations.
Reasonable and necessary purposes to implement the relevant service agreement or this Privacy Policy, safeguard social and public interests, handle complaints/disputes, and protect the personal and property safety or legitimate rights and interests of our customers, us or our affiliates, other users or employees.
We strive to keep information secure against loss, misuse, unauthorized access or disclosure.
We use various security technologies to keep information secure. For example, we will take security measures such as server backup and password encryption to prevent information leakage, damage and loss. We have established strict management systems and procedures to ensure the security of information. For example, we strictly limit the scope of people who have access to information and conduct audits that require them to comply with confidentiality obligations.
We attach great importance to information security compliance and fully protect your information security with industry-leading solutions. However, please understand that due to technical limitations and various malicious means that may exist, in the Internet environment, even if we do our best to strengthen security measures, it is impossible to always ensure 100% information security. You need to understand that the systems and communication networks you use to access our services may have problems due to factors beyond our control. In the event of a security incident such as personal information leakage, we will activate contingency plans to prevent the expansion of security incidents, report them in a timely manner in accordance with relevant regulations, and notify you of the relevant situation by sending emails, push notifications, announcements, etc., and give you security advice.
8. Exceptions Due to Prior Authorization Consent
In the following situations, sharing, transferring and publicly disclosing your personal information does not require your prior authorization and consent:
In response to a request for information if we believe disclosure is in accordance with or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. Related to national security and national defence security.
With our service providers, consultants or law enforcement authorities if we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of API7.ai or others. Related to public safety, public health, and major public interests. With a prospective or actual purchaser in connection with, or during negotiations of, any merger, sale of our assets, financing or acquisition of all or a portion of our business by another company.Related to criminal investigation, prosecution, trial and execution of judgments.
Between and among API7 and our current and future parents, affiliates, subsidiaries and other companies under common control and ownership for the protection of your or other personal life, property and other major legitimate rights and interests, but it is difficult to obtain personal consent.
The personal information you disclose to the public by yourself.
Collect personal information from legally publicly disclosed information, such as legal news reports, government information disclosure and other channels.
Necessary for maintaining the safe and stable operation of products and related services, such as finding and disposing of failures of products and related services.
According to the law, sharing and transferring de-identified personal information and ensuring that the data recipient cannot recover and re-identify the subject of the personal information is not an external sharing, transfer or public disclosure of personal information. The storage and processing of such information will be carried out without further notice and consent to you.
You are especially reminded that if the information cannot identify you individually or in combination with other information, it does not belong to your personal information in the legal sense. When your information, alone or in combination with other information, can identify you personally or when we use data that cannot be linked to any specific personal information in combination with other personal information about you, such information will be treated and protected as your personal information in accordance with this Privacy Policy during the combined use.
9. Processing of Personal Information of Minors
Minors may not create their own user accounts without the consent of their parents or guardians. If you are minor, it is recommended that you ask your parents or guardians to read this Privacy Policy carefully, and use our services or provide us with information with the consent of your parents or guardians.
For the collection of minors' personal information using our products or services with the consent of parents or guardians, we will only use, share, transfer or disclose this information as permitted by laws and regulations, with the express consent of a parent or guardian, or as necessary to protect minors.
10. International Data Transfers
API7.ai is based in Singapore and also processes and stores information in Singapore. As such, we and our service providers may transfer your information to, or store or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. We will take appropriate steps to ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests, including through the use of standard contractual clauses approved by the authorities in your jurisdiction.
11. How this Privacy Policy is Updated?
Our Privacy Policy may be updated. Without your express consent, we will not limit your rights under this Privacy Policy. We will post any changes to the Privacy Policy. For material changes, we will also provide a more prominent notice.
Material changes referred to in this policy include, but are not limited to:
Significant changes have been made to our service model, such as the purpose of processing personal information, the types of personal information processed, and how personal information is used.
Significant changes in control rights, such as changes in information controllers caused by mergers and acquisitions, etc.
The main object of personal information sharing, transfer or public disclosure has changed. Material changes to your rights to participate in the processing of personal information and how to exercise them.
Our responsible department for handling personal information security, contact information and complaint channels has changed.
Any personal information security impact assessment report indicates a high risk. We will also archive older versions of this Privacy Policy on our official website for your reference.
12. How to Contact Us?
If you have any questions about this policy or other related matters, please send your questions to support@api7.ai or contact us through the company's official website. We will review the issue as soon as possible and respond within thirty days of verifying your user identity.
API7 Cloud Privacy Notice
Effective date: November 9, 2026
APISEVEN PTE. LTD. (“API7”, “we”, or “us”) provides API7 Cloud. This notice explains how we handle personal data for our own purposes when you register for, administer, or use API7 Cloud, or contact us about the service. This notice supplements the general Privacy Policy for API7 Cloud and governs in the event of a conflict about those practices.
1. Who is responsible for the data
API7 is responsible for personal data it uses to manage accounts, authenticate users, administer subscriptions, bill customers, protect the hosted service, or communicate with users and business contacts. Your organization may provide information about you when it invites you to an account or makes its identity provider available for sign-in.
When your organization instructs API7 to process personal data on its behalf in its configurations, connected systems, Cloud Assistant interactions, or support materials, the applicable data processing agreement governs that processing. Your organization can tell you how it uses this information and how to exercise rights in relation to it. We may process the same type of data for different purposes. For example, we may use your work email to administer your sign-in while using contact information in a customer-provided configuration only on the customer's instructions.
2. What we collect
Account and organization information. Your work email, name if provided, organization, role, invitations, and access settings. If you use a sign-in provider, such as Google, Microsoft, or your organization's single sign-on provider, we may receive your provider account identifier, email address, name, and profile image, as made available by that provider and your organization's settings.
Billing and business information. Billing contacts and details, plan, invoices, usage used for billing, and payment status. If you pay by card, you enter the full card number and security code on Stripe's hosted page. API7 receives payment identifiers and limited card details, such as the brand, last four digits, and expiration date.
Sign-in, device, and service activity. Authentication events, IP address, and browser or device information associated with use of the console. Administrative audit records can include the user identifier or name, IP address, action, resource, and time.
Communications and support. Contact details, messages, and materials you send to us through support tickets or online chat. We use those communications to respond to you. Where we handle customer-provided personal data on behalf of an organization in order to resolve the issue, the applicable data processing agreement applies.
When you use Cloud Assistant, we process your questions and relevant conversation context to provide answers and keep your conversation history. Answers are generated by AI models that API7 operates on our hosting providers' infrastructure. API7 does not use your questions to train AI models.
API7 operates the hosted control plane. API and AI gateway runtime traffic stays in the customer's environment. For runtime monitoring, API7 receives aggregate metrics, such as request counts, status code distributions, and latency. These metrics do not include per-request records, client IP addresses, full URLs, request IDs, or API consumer identifiers. Account sign-in and administrative activity are separate from gateway runtime monitoring.
3. Why we use the data
Where the GDPR or UK GDPR applies, the table describes the legal grounds for these purposes.
Purpose Legal grounds where applicable
Create and manage accounts, authenticate users, deliver the subscribed service, and respond to service requests Performance of a contract where you are a party, or our legitimate interests in operating the service and managing the relationship with the organization you represent
Manage billing, collect fees, and maintain business records Performance of a contract where you are a party, our legitimate interests in managing commercial accounts, and legal obligations such as tax and accounting
Protect accounts and infrastructure, diagnose service issues, and prevent fraud or abuse Our legitimate interests in service reliability and security, and legal obligations where they apply
Improve service reliability and usability Our legitimate interests in understanding and improving the service, or consent when required for optional analytics or tracking
Send optional marketing Consent where required, or our legitimate interests in communicating with relevant business contacts where permitted
Comply with lawful requests and preserve or defend legal claims Legal obligations or our legitimate interests in protecting our rights
We use required sign-in information to establish and protect your account. If you choose to withhold it, we may be unable to create your account or provide the relevant service. You can unsubscribe from marketing emails using the link in the message. We may still send service messages about your account or security. Where we rely on consent, you can withdraw it at any time. We use cookies for sign-in, session management, and security. The Crisp support widget on signed-in organization pages may use cookies to maintain chat sessions and restore conversation history. Where optional analytics or marketing technologies are offered, we ask for consent where required by law and provide a way to withdraw it. See the Crisp Cookie Policy for information about chat cookies.
4. Who receives the data
We disclose personal data to providers that help us operate the service, such as hosting, security, authentication, email delivery, support, billing, and monitoring providers, as applicable. We use AWS and Microsoft Azure for production hosting, Zendesk for support tickets, Crisp for online chat, and Resend for login codes, organization invitations, billing notifications, and alerts. The Console sends Crisp an opaque user identifier to associate the chat session with your account. Crisp also receives any information you submit through the widget and may collect browser and network information when the widget loads. We use Stripe for card payments. If you buy through a cloud marketplace, the applicable marketplace processes subscription and billing information. Identity and payment providers may also handle data for their own purposes under their own notices. Organization owners and authorized administrators can view or manage your organization profile and access, and can view audit activity for their organization. We may also disclose data as required by law or in connection with a corporate transaction subject to appropriate safeguards.
5. Where we process and how long we keep it
The plan and documentation describe the control-plane regions available to your organization. The selected control-plane region describes where the applicable control plane operates. Account, billing, support, Cloud Assistant, backup, and security data may be stored or accessed separately from the selected control plane, including by our service providers and authorized personnel where they operate.
When applicable law requires a safeguard for an international transfer, we use an appropriate mechanism, which may include a recognized adequacy decision or applicable standard contractual clauses. Contact us to ask about the safeguard relevant to your information and how to obtain a copy.
We keep account information while needed to administer your access. We keep billing records for accounting, tax, and payment disputes, and support tickets and chat messages to handle requests and related follow-up. We keep sign-in, audit, and delivery records as needed for security, troubleshooting, and service delivery. The standard retention period for Console audit events and Cloud Assistant messages is 90 days. Retention depends on the purpose of the record and may be extended where necessary to meet legal obligations, resolve disputes, or protect the service. We delete or anonymize personal data when we no longer need it for these purposes. Backup copies are restricted to recovery and expire under the applicable rotation schedule. The applicable data processing agreement sets the return or deletion terms for personal data we process on behalf of a customer.
6. Your rights and how to contact us
Depending on your location, you may have rights to access or correct your personal data, request deletion or portability, restrict or object to processing, or withdraw consent. You may also be entitled to complain to your local data protection authority. To submit a request or ask about this notice, email support@api7.ai. Our registered office is APISEVEN PTE. LTD., 390 Orchard Road, #12-04 Palais Renaissance, Singapore 238871. We may verify your identity before acting on a request. Where we process data on behalf of your organization, we will direct the request to the organization or assist it in responding as appropriate.
We will post changes to this notice with the updated effective date and provide additional notice of material changes where required.